This article examines the security implications of the Model Context Protocol (MCP) sampling feature in the context of a widely used coding copilot application.
MCP is a standard for connecting large language model (LLM) applications to external data sources and tools. We show that, without proper safeguards, malicious MCP servers can exploit the sampling feature for a range of attacks. We demonstrate these risks in practice through three proof-of-concept (PoC) examples conducted within the coding copilot, and discuss strategies for effective prevention.
Read more…
Source: Palo Alto Unit 42
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Hacktivist attacks erupt in Middle East following Hamas assault on Israel
October 9, 2023
Groups range from known collectives to new outfits eager to raise their profile Hacktivism efforts have proliferated rapidly in the Middle East following the official announcement of a war between Palestine and Israel.… The escalation was spurred by a deadly attack on a music festival by Hamas, along with abductions and killings across scores of Israeli ...
- R2R stomping – are you ready to run?
October 9, 2023
What if we told you that the reality you perceive with your very own eyes is not always what it seems? That the .NET code you witness executing within your beloved managed debugger, such as dnSpy/dnSpyEx, may not necessarily be the same code that operates outside of its bounds? .NET application startup time and latency ...
- Cyber attack hits electronics firm Volex
October 9, 2023
A cyber attack has hit electronic manufacturer Volex, opening the door to unauthorised access to some of its IT systems. The AIM-listed British company said it is not expecting any “material” financial impact from the incident but shares dropped over four per cent on Monday morning. After discovering the breach of certain IT systems and data ...
- India Space Agency fights 100 cyber hacking bids daily
October 8, 2023
India’s space agency Isro is facing more than 100 cyber-hacking attempts on a daily basis, disclosed its chairman S Somanath on Sunday. Speaking to TOI, Somanath said, “It is not only Isro, but several other systems (of other organisations) that face hundreds of cyber (hacking) attempts. But such attempts have been stopped by our several ...
- 23andMe user data breached in credential-stuffing attack
October 7, 2023
Biotech company 23andMe, known for its DNA testing kits, said the leak occurred through a credential-stuffing attack. A credential-stuffing attack involves user information that has already been compromised (usernames and passwords, for example) from one organization, which a hacker obtains and attempts to reuse with a second organization — in this case, 23andMe. Because of the ...
- Qakbot-affiliated actors distribute Ransom Knight malware despite infrastructure takedown
October 5, 2023
In a late August 2023 operation involving the FBI and many international partners, law enforcement agencies seized the infrastructure and cryptocurrency assets used by the Qakbot malware, dealing considerable damage to the group’s operations. Many people in the security industry wondered whether this would mean that the Qakbot affiliates were gone forever or just temporarily ...